This vulnerability affects Totolink CA750-PoE version 6.2c.510. It arises from improper input handling in the recvUpgradeNewFw function of the /cgi-bin/cstecgi.cgi Setting Handler component. By manipulating the fwUrl or magicid parameters, an attacker can inject OS commands remotely, potentially executing arbitrary commands on the device. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. There is no vendor advisory or patch currently available, and the exploit is publicly known.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially compromising device integrity and control. Given the medium CVSS score and remote attack vector with no required user interaction, this could lead to unauthorized device manipulation or disruption of network services relying on the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the device's management interface from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.